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20. A method for policy-based billing for a 
network session, comprising: 



(a) receiving a plurality of packets at a plurality of 
analyzers; 

(b) aggregating the plurality of packets; 



(c) analyzing the plurality of packets to identify a 
plurality of flows; 



(d) identifying a session associated with the flows; 



(e) identifying at least one application associated 
with the session; 

(f) reconstructing the session utilizing the 
identified application; 



(g) identifying a user associated with the session; 

(h) determining a policy; and 



"NARUS offers the only billing mediation solu- 
tion for differentiated services providing 
application-level usage information in real time 
and on a per subscriber basis." (See Appendix E) 

"The NARUS Policy Abuse Detection Solution provides 
abuse and fraud detection capabilities which enable 
MSOs to identify abusers and help decide whether to 
terminate them or bill them based on resource usage." 
See Appendix E) 

"NARUS Analyzers [which function] to capture IP 
session information. . . in real-time" (See Appendix B) 

IP traffic is referred to as "packets" in Appendix C. 

The Narus Business Infrastructure Platform discloses 
"data-flow analysis" and "by using data filtering, 
transformation, and aggregation techniques, they 
optimize data collection across all applications and, 
where applicable, repurpose the collected data for 
multiple applications." (See Appendix B) 

The Narus Business Infrastructure Platform discloses 
"Analyzers [that] access these network elements, retrieve 
session data, and parse various data formats to generate 
meaningful usage information." (See Appendix B) 

The Narus Business Infrastructure Platform discloses a 
"software server that applies user-defined policies to raw 
session details received from NARUS Analyzers. By 
compiling session details from multiple Analyzers and 
applying subscriber related information, the LogicServer 
provides a comprehensive view of customer session 
activity." (See Appendix B) 

"The NARUS Analyzers reconstruct the traffic in real 
time, based on an application-level understanding of the 
IP traffic." (See Appendices A and B) 

The Narus Business Infrastructure Platform discloses 
"Analyzers [that] access these network elements, retrieve 
session data, and parse various data formats to generate 
meaningful usage information." (See Appendix B) 

The Narus Business Infrastructure Platform discloses a 
"software server that applies user-defined policies to raw 
session details received from NARUS Analyzers. By 
compiling session details from multiple Analyzers and 
applying subscriber related information, the LogicServer 
provides a comprehensive view of customer session 
activity." (See Appendix B) 

"NARUS offers the only billing mediation solu- 

tion for differentiated services providing 



CONFIDENTIAL 



INVESTIGATION OF U.S. PATENT APP. SER. NO. 09/935,131 

Claims 20 and 30 of U.S. Patent App. Ser. No. 09/935.131 Narus Busine ss Infrastructure Platform 



(i) billing the user for the session in accordance 
with the policy. 



30. A computer program product for policy-based 
billing for a network session, comprising: 

(a) computer code for receiving a plurality of 
packets at a plurality of analyzers; 

(b) computer code for aggregating the plurality of 
packets; 

(c) computer code for analyzing the plurality of 
packets to identify a plurality of flows; 

(d) computer code for identifying a session 
associated with the flows; " 

(e) computer code for identifying at least one 
application associated with the session; 

(f) computer code for reconstructing the session 
utilizing the identified application; 

(g) computer code for identifying a user associated 
with the session; 

(h) computer code for determining a policy; and 

(i) computer code for billing the user for the 
session in accordance with the policy. 



application-level usage information in real time 
and on a per subscriber basis." (See Appendix E) 

"The NARUS Policy Abuse Detection Solution provides 
abuse and fraud detection capabilities which enable 
MSOs to identify abusers and help decide whether to 
terminate them or bill them based on resource usage." 
See Appendix E) 

See also Appendices A-E. 

"The LogicServer is a real-time, high-performance 
software server".."NARUS Virtual Analyzers are 
lightweight software".."NARUS LogicServer™ 
software" (See Appendix B) 

See also the analysis above relating to Claim 20. 
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